CVE-2026-27347: WordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability
Published Sep 4, 2026
·Updated
Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects JetPopup: from n/a through 2.0.20.2.
Affected Software
1 affected component
JetPopup<=2.0.20.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetPopup Pluginto a version that resolves this vulnerability.Fixed in 2.0.20.3
Event History
Sep 4, 2026
CVE Published
via MITRE·10:49 AM
Data Sourced
via MITRE·10:49 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which JetPopup versions are affected?
JetPopup versions through 2.0.20.2 are affected. The earliest affected version is not specified.
2
Does exploiting this issue require authentication or user interaction?
The supplied CVSS vector indicates that exploitation can be performed remotely without privileges or user interaction. It also indicates low attack complexity.
3
What is the expected impact if this vulnerability is exploited?
The provided severity data indicates low confidentiality impact, with no integrity or availability impact indicated.